fix(auth): accept active WorkOS client during Convex deploy

[anand-testcompare]

Summary

• include the active production WorkOS client when Convex still reads older preview client ids during deploy
• add focused coverage for WorkOS client-id expansion

Verification

• bunx vitest run convex/auth.config.test.ts --reporter=default
• cd packages/backend && bun run test
• bun x ultracite fix
• bun run check-types
• NEXT_PUBLIC_CONVEX_URL=https://impartial-rat-992.convex.cloud bun run build

Production note

• manually redeployed Vercel production so www.sketchi.app now points at https://impartial-rat-992.convex.cloud, whose WorkOS client id is client_01KG0NPZN3AWXNTRHC58VAPVW2

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
sketchi	Error		May 21, 2026 6:37am
sketchi-web	Ready	Preview, Comment	May 21, 2026 6:37am

[github-actions]

Browserbase Replays

• Session b9af38e8-7438-4c5c-af6f-88d2815090bb (scenario: visual-sanity.ts): replay | debug
• Session 37c5d70a-a09b-4b12-aab1-aa6b904ba863 (scenario: auth-gates.ts): replay | debug
• Session e16a30f6-5182-47aa-ad6f-8e097f9e19cc (scenario: opencode-web-continuity.ts): replay | debug
• Session 3b94f4b0-fee7-4a0c-aeb7-392ada995dcf (scenario: diagram-studio-happy-path.ts): replay | debug
• Session 0b1e917a-f87c-418c-b68e-0fabfd1b53c8 (scenario: diagram-studio-occ-conflict.ts): replay | debug

Workflow run: 26209812154